@prosopo/provider 5.14.0 → 5.16.0

package/.turbo/turbo-build.log

@@ -1,61 +1,59 @@
-
-> @prosopo/provider@5.14.0 build
-> npm run build:cross-env -- --mode ${NODE_ENV:-development}
-
-
-> @prosopo/provider@5.14.0 build:cross-env
-> vite build --config vite.esm.config.ts --mode production
-
+$ pnpm run build:cross-env --mode ${NODE_ENV:-development}
+$ vite build --config vite.esm.config.ts --mode production
 ViteEsmConfig: .
 {
   tsConfigPaths: [
-    '/home/runner/work/captcha/captcha/packages/api-route/tsconfig.json',
-    '/home/runner/work/captcha/captcha/packages/logger/tsconfig.json',
+    '/home/runner/work/captcha/captcha/packages/api/tsconfig.json',
+    '/home/runner/work/captcha/captcha/packages/types/tsconfig.json',
+    '/home/runner/work/captcha/captcha/packages/locale/tsconfig.json',
     '/home/runner/work/captcha/captcha/packages/util/tsconfig.json',
+    '/home/runner/work/captcha/captcha/packages/util-crypto/tsconfig.json',
     '/home/runner/work/captcha/captcha/packages/api-express-router/tsconfig.json',
+    '/home/runner/work/captcha/captcha/packages/api-route/tsconfig.json',
+    '/home/runner/work/captcha/captcha/packages/logger/tsconfig.json',
     '/home/runner/work/captcha/captcha/packages/common/tsconfig.json',
-    '/home/runner/work/captcha/captcha/packages/locale/tsconfig.json',
-    '/home/runner/work/captcha/captcha/packages/types/tsconfig.json',
-    '/home/runner/work/captcha/captcha/packages/util-crypto/tsconfig.json',
     '/home/runner/work/captcha/captcha/packages/env/tsconfig.json',
     '/home/runner/work/captcha/captcha/packages/ipinfo/tsconfig.json',
     '/home/runner/work/captcha/captcha/packages/database/tsconfig.json',
     '/home/runner/work/captcha/captcha/packages/types-database/tsconfig.json',
     '/home/runner/work/captcha/captcha/packages/user-access-policy/tsconfig.json',
     '/home/runner/work/captcha/captcha/packages/redis-client/tsconfig.json',
-    '/home/runner/work/captcha/captcha/packages/api/tsconfig.json',
     '/home/runner/work/captcha/captcha/packages/types-env/tsconfig.json',
     '/home/runner/work/captcha/captcha/packages/keyring/tsconfig.json',
+    '/home/runner/work/captcha/captcha/packages/audio-assets/tsconfig.json',
+    '/home/runner/work/captcha/captcha/packages/puzzle-assets/tsconfig.json',
     '/home/runner/work/captcha/captcha/packages/captcha-severity/tsconfig.json',
     '/home/runner/work/captcha/captcha/packages/datasets/tsconfig.json',
+    '/home/runner/work/captcha/captcha/packages/icon-order-assets/tsconfig.json',
     '/home/runner/work/captcha/captcha/packages/load-balancer/tsconfig.json',
-    '/home/runner/work/captcha/captcha/packages/puzzle-assets/tsconfig.json',
     '/home/runner/work/captcha/captcha/packages/web-bot-auth/tsconfig.json'
   ]
 }
 {
   externals: [
-    '@prosopo/api-route',
-    '@prosopo/logger',
+    '@prosopo/api',
+    '@prosopo/types',
+    '@prosopo/locale',
     '@prosopo/util',
+    '@prosopo/util-crypto',
     '@prosopo/api-express-router',
+    '@prosopo/api-route',
+    '@prosopo/logger',
     '@prosopo/common',
-    '@prosopo/locale',
-    '@prosopo/types',
-    '@prosopo/util-crypto',
     '@prosopo/env',
     '@prosopo/ipinfo',
     '@prosopo/database',
     '@prosopo/types-database',
     '@prosopo/user-access-policy',
     '@prosopo/redis-client',
-    '@prosopo/api',
     '@prosopo/types-env',
     '@prosopo/keyring',
+    '@prosopo/audio-assets',
+    '@prosopo/puzzle-assets',
     '@prosopo/captcha-severity',
     '@prosopo/datasets',
+    '@prosopo/icon-order-assets',
     '@prosopo/load-balancer',
-    '@prosopo/puzzle-assets',
     '@prosopo/web-bot-auth'
   ]
 }
@@ -63,7 +61,7 @@ ViteEsmConfig: .
 vite v8.1.5 building ssr environment for production...
 Bundle build started
 
-✓ 120 modules transformed.
+✓ 135 modules transformed.
 rendering chunks...
 computing gzip size...
 dist/_virtual/_rolldown/runtime.js                                        0.04 kB │ gzip: 0.06 kB
@@ -81,96 +79,111 @@ dist/utils/hashUserIp.js                                                  0.52 k
 dist/api/testSiteKey.js                                                   0.56 kB │ gzip: 0.30 kB
 dist/utils/hashUserAgent.js                                               0.63 kB │ gzip: 0.39 kB
 dist/api/validateAddress.js                                               0.70 kB │ gzip: 0.33 kB
+dist/tasks/audioCaptcha/audioTasksUtils.js                                0.75 kB │ gzip: 0.44 kB
+dist/api/captcha/getFrictionlessCaptchaChallenge/refreshLineage.js        0.80 kB │ gzip: 0.46 kB
 dist/api/dnsEventUrl.js                                                   0.80 kB │ gzip: 0.44 kB
 dist/api/ja4.js                                                           0.80 kB │ gzip: 0.44 kB
+dist/api/captcha/submitAudioCaptchaSolution.js                            0.83 kB │ gzip: 0.40 kB
+dist/api/captcha/submitIconOrderCaptchaSolution.js                        0.84 kB │ gzip: 0.39 kB
 dist/tasks/dataset/datasetTasks.js                                        0.85 kB │ gzip: 0.39 kB
-dist/tasks/powCaptcha/powTasksUtils.js                                    0.89 kB │ gzip: 0.46 kB
+dist/api/captcha/submitPuzzleCaptchaSolution.js                           0.86 kB │ gzip: 0.41 kB
 dist/api/captcha/assetSeal.js                                             0.91 kB │ gzip: 0.50 kB
 dist/api/headerCheckMiddleware.js                                         0.91 kB │ gzip: 0.43 kB
 dist/api/captcha/getFrictionlessCaptchaChallenge/honeypotResponse.js      0.95 kB │ gzip: 0.51 kB
 dist/api/admin/apiRegisterSiteKeyEndpoint.js                              1.00 kB │ gzip: 0.46 kB
 dist/api/captcha/getFrictionlessCaptchaChallenge/sessionDedup.js          1.01 kB │ gzip: 0.45 kB
-dist/api/captcha/getFrictionlessCaptchaChallenge/constants.js             1.04 kB │ gzip: 0.57 kB
-dist/tasks/puzzle/nativeBackground.js                                     1.06 kB │ gzip: 0.58 kB
 dist/api/detectorPoolBodyParser.js                                        1.07 kB │ gzip: 0.57 kB
 dist/api/admin/apiRemoveSiteKeysEndpoint.js                               1.07 kB │ gzip: 0.48 kB
+dist/tasks/powCaptcha/powTasksUtils.js                                    1.07 kB │ gzip: 0.54 kB
 dist/api/admin/apiRegisterSiteKeysEndpoint.js                             1.08 kB │ gzip: 0.50 kB
 dist/api/admin/apiRemoveSiteKeyEndpoint.js                                1.08 kB │ gzip: 0.48 kB
 dist/api/block.js                                                         1.08 kB │ gzip: 0.46 kB
 dist/schedulers/captchaScheduler.js                                       1.11 kB │ gzip: 0.48 kB
 dist/utils/normalizeRequestIp.js                                          1.14 kB │ gzip: 0.52 kB
 dist/schedulers/getClientList.js                                          1.19 kB │ gzip: 0.53 kB
+dist/tasks/puzzle/nativeBackground.js                                     1.21 kB │ gzip: 0.64 kB
 dist/api/admin/apiGetDecisionMachineEndpoint.js                           1.26 kB │ gzip: 0.50 kB
-dist/tasks/puzzle/backgroundBuffer.js                                     1.26 kB │ gzip: 0.51 kB
 dist/api/admin/apiRemoveAllDecisionMachinesEndpoint.js                    1.27 kB │ gzip: 0.51 kB
+dist/tasks/puzzle/backgroundBuffer.js                                     1.27 kB │ gzip: 0.51 kB
 dist/api/admin/apiRemoveDecisionMachineEndpoint.js                        1.29 kB │ gzip: 0.51 kB
+dist/tasks/audio/audioRenderer.js                                         1.29 kB │ gzip: 0.58 kB
 dist/tasks/dataset/datasetTasksUtils.js                                   1.33 kB │ gzip: 0.48 kB
 dist/api/assetDocument.js                                                 1.36 kB │ gzip: 0.75 kB
+dist/tasks/audioAlternative.js                                            1.40 kB │ gzip: 0.56 kB
 dist/tasks/detection/assignSecret.js                                      1.42 kB │ gzip: 0.74 kB
 dist/utils/clientMetaData.js                                              1.42 kB │ gzip: 0.72 kB
 dist/api/admin/apiGetAllDecisionMachinesEndpoint.js                       1.48 kB │ gzip: 0.57 kB
 dist/schedulers/updateSpamEmailDomains.js                                 1.52 kB │ gzip: 0.60 kB
 dist/api/admin/apiReplaceDetectorPoolEndpoint.js                          1.57 kB │ gzip: 0.68 kB
 dist/api/ja4Middleware.js                                                 1.59 kB │ gzip: 0.75 kB
+dist/api/captcha/getFrictionlessCaptchaChallenge/constants.js             1.61 kB │ gzip: 0.76 kB
 dist/utils/honeypot/encoders.js                                           1.62 kB │ gzip: 0.67 kB
 dist/api/admin/apiGetSessionEndpoint.js                                   1.66 kB │ gzip: 0.80 kB
-dist/api/admin/apiToggleMaintenanceModeEndpoint.js                        1.66 kB │ gzip: 0.69 kB
 dist/api/adminAuthOptions.js                                              1.67 kB │ gzip: 0.79 kB
 dist/tasks/imgCaptcha/imgCaptchaTasksUtils.js                             1.67 kB │ gzip: 0.74 kB
 dist/utils/devicePlatform.js                                              1.68 kB │ gzip: 0.90 kB
 dist/api/admin/apiUpdateDecisionMachineEndpoint.js                        1.68 kB │ gzip: 0.58 kB
 dist/utils/honeypot/phraseBank.js                                         1.69 kB │ gzip: 0.84 kB
 dist/api/handshakeTimingMiddleware.js                                     1.75 kB │ gzip: 0.69 kB
+dist/tasks/iconOrder/iconOrderRenderer.js                                 1.77 kB │ gzip: 0.71 kB
 dist/tasks/spam/updateSpamEmailDomains.js                                 1.87 kB │ gzip: 0.77 kB
+dist/api/captcha/getAudioCaptchaChallenge.js                              1.87 kB │ gzip: 0.72 kB
 dist/api/admin/apiClearAllCountersEndpoint.js                             1.89 kB │ gzip: 0.76 kB
 dist/api/requestBodySummary.js                                            1.94 kB │ gzip: 0.88 kB
 dist/tasks/frictionless/ipMatch.js                                        1.98 kB │ gzip: 1.02 kB
 dist/api/captcha/signedAssetsResolver.js                                  2.08 kB │ gzip: 0.98 kB
 dist/migrations/frictionlessLadder.js                                     2.12 kB │ gzip: 0.93 kB
 dist/tasks/puzzle/stratifiedSampler.js                                    2.14 kB │ gzip: 1.07 kB
+dist/tasks/audio/audioBuffer.js                                           2.15 kB │ gzip: 0.83 kB
 dist/tasks/frictionless/frictionlessTasksUtils.js                         2.16 kB │ gzip: 1.09 kB
-dist/api/captcha/maintenanceModeResponses.js                              2.16 kB │ gzip: 0.73 kB
 dist/tasks/frictionless/routingMachine.js                                 2.20 kB │ gzip: 0.93 kB
-dist/tasks/captchaTypeSelection.js                                        2.22 kB │ gzip: 1.03 kB
+dist/api/captcha/interactiveCaptchaSolution.js                            2.24 kB │ gzip: 0.88 kB
 dist/api/captcha/sealedAssetsResolver.js                                  2.26 kB │ gzip: 0.97 kB
+dist/tasks/audioCaptcha/audioTasks.js                                     2.30 kB │ gzip: 0.84 kB
+dist/api/captcha/getIconOrderCaptchaChallenge.js                          2.31 kB │ gzip: 0.79 kB
 dist/utils/dns.js                                                         2.36 kB │ gzip: 0.95 kB
 dist/api/public.js                                                        2.45 kB │ gzip: 0.98 kB
 dist/api/captcha/checkSpamEmail.js                                        2.47 kB │ gzip: 0.91 kB
 dist/tasks/puzzle/puzzleDifficulty.js                                     2.50 kB │ gzip: 1.09 kB
 dist/api/forwardVerify.js                                                 2.59 kB │ gzip: 1.10 kB
-dist/api/captcha/submitPuzzleCaptchaSolution.js                           2.65 kB │ gzip: 0.99 kB
+dist/tasks/iconOrderCaptcha/iconOrderTasks.js                             2.59 kB │ gzip: 0.98 kB
 dist/api/captcha/submitImageCaptchaSolution.js                            2.69 kB │ gzip: 1.03 kB
 dist/api/admin/apiAdminRoutesProvider.js                                  2.78 kB │ gzip: 0.55 kB
 dist/index.js                                                             2.95 kB │ gzip: 0.81 kB
 dist/api/admin/apiDnsEventEndpoint.js                                     3.05 kB │ gzip: 1.18 kB
-dist/compositeIpAddress.js                                                3.15 kB │ gzip: 1.34 kB
 dist/tasks/detection/getBotScore.js                                       3.29 kB │ gzip: 1.32 kB
 dist/api/captcha/assetSealFormat.js                                       3.38 kB │ gzip: 1.34 kB
-dist/api/captcha/getFrictionlessCaptchaChallenge/shortCircuit.js          3.39 kB │ gzip: 1.32 kB
+dist/api/captcha/maintenanceModeResponses.js                              3.39 kB │ gzip: 0.87 kB
 dist/api/captcha/assignDetectorBundle.js                                  3.40 kB │ gzip: 1.34 kB
-dist/tasks/tasks.js                                                       3.44 kB │ gzip: 1.01 kB
+dist/api/captcha/getFrictionlessCaptchaChallenge/shortCircuit.js          3.51 kB │ gzip: 1.33 kB
+dist/api/captcha/getPuzzleCaptchaChallenge.js                             3.58 kB │ gzip: 1.16 kB
 dist/api/domainMiddleware.js                                              3.61 kB │ gzip: 1.24 kB
 dist/utils/tarpitPadding.js                                               3.67 kB │ gzip: 1.51 kB
-dist/api/rawTlsSignalsMiddleware.js                                       3.69 kB │ gzip: 1.13 kB
+dist/tasks/puzzleCaptcha/puzzleTasks.js                                   3.67 kB │ gzip: 1.18 kB
+dist/tasks/captchaTypeSelection.js                                        3.73 kB │ gzip: 1.58 kB
 dist/tasks/spam/evaluateEmailSpamRules.js                                 3.84 kB │ gzip: 1.59 kB
-dist/tasks/puzzle/puzzleRenderer.js                                       3.99 kB │ gzip: 1.52 kB
+dist/api/admin/apiToggleMaintenanceModeEndpoint.js                        3.85 kB │ gzip: 1.44 kB
+dist/compositeIpAddress.js                                                3.87 kB │ gzip: 1.66 kB
+dist/tasks/tasks.js                                                       3.93 kB │ gzip: 1.07 kB
+dist/tasks/puzzle/puzzleRenderer.js                                       4.02 kB │ gzip: 1.53 kB
 dist/services/ipComparison.js                                             4.04 kB │ gzip: 1.21 kB
-dist/api/captcha/trafficFilterRequestTime.js                              4.06 kB │ gzip: 1.53 kB
 dist/tasks/spam/checkSpamEmail.js                                         4.12 kB │ gzip: 1.12 kB
 dist/api/cpuProfiler.js                                                   4.12 kB │ gzip: 1.77 kB
-dist/api/captcha.js                                                       4.15 kB │ gzip: 1.35 kB
+dist/api/captcha/trafficFilterRequestTime.js                              4.20 kB │ gzip: 1.56 kB
 dist/api/hardBlockVerdictCache.js                                         4.26 kB │ gzip: 1.72 kB
 dist/pairs.js                                                             4.27 kB │ gzip: 1.57 kB
 dist/api/captcha/getFrictionlessCaptchaChallenge/accessPolicy.js          4.35 kB │ gzip: 1.07 kB
 dist/tasks/dnsEvent/enrichDnsEvent.js                                     4.71 kB │ gzip: 1.72 kB
+dist/api/captcha.js                                                       5.02 kB │ gzip: 1.44 kB
 dist/tasks/detection/decoderPool.js                                       5.34 kB │ gzip: 2.02 kB
+dist/api/captcha/interactiveCaptchaChallenge.js                           5.47 kB │ gzip: 1.77 kB
 dist/util/usageCounters.js                                                5.65 kB │ gzip: 2.01 kB
-dist/api/captcha/getPoWCaptchaChallenge.js                                6.25 kB │ gzip: 1.87 kB
+dist/api/rawTlsSignalsMiddleware.js                                       6.25 kB │ gzip: 1.95 kB
+dist/api/captcha/getPoWCaptchaChallenge.js                                6.25 kB │ gzip: 1.88 kB
 dist/api/captcha/getImageCaptchaChallenge.js                              6.69 kB │ gzip: 2.03 kB
 dist/api/healthzGeo.js                                                    6.86 kB │ gzip: 2.68 kB
-dist/api/captcha/getPuzzleCaptchaChallenge.js                             7.00 kB │ gzip: 2.01 kB
-dist/tasks/spam/checkTrafficFilter.js                                     7.63 kB │ gzip: 2.61 kB
-dist/api/captcha/submitPoWCaptchaSolution.js                              8.70 kB │ gzip: 2.69 kB
+dist/tasks/spam/checkTrafficFilter.js                                     8.17 kB │ gzip: 2.75 kB
+dist/api/captcha/submitPoWCaptchaSolution.js                              8.72 kB │ gzip: 2.71 kB
 dist/tasks/detection/bundlePool.js                                        8.86 kB │ gzip: 3.34 kB
 dist/api/captcha/getFrictionlessCaptchaChallenge/decisionMachine.js       9.36 kB │ gzip: 1.80 kB
 dist/api/startProviderApi.js                                             10.22 kB │ gzip: 3.50 kB
@@ -179,15 +192,15 @@ dist/tasks/decisionMachine/decisionMachineRunner.js                      12.28 k
 dist/util.js                                                             12.47 kB │ gzip: 3.20 kB
 dist/api/blacklistRequestInspector.js                                    12.75 kB │ gzip: 4.46 kB
 dist/api/metrics.js                                                      13.17 kB │ gzip: 4.27 kB
-dist/api/verify.js                                                       16.55 kB │ gzip: 3.04 kB
-dist/tasks/frictionless/frictionlessTasks.js                             17.86 kB │ gzip: 4.86 kB
-dist/api/captcha/getFrictionlessCaptchaChallenge/handler.js              18.63 kB │ gzip: 4.53 kB
-dist/tasks/puzzleCaptcha/puzzleTasks.js                                  22.85 kB │ gzip: 5.14 kB
-dist/tasks/powCaptcha/powTasks.js                                        24.56 kB │ gzip: 6.17 kB
-dist/tasks/captchaManager.js                                             24.61 kB │ gzip: 7.41 kB
-dist/tasks/imgCaptcha/imgCaptchaTasks.js                                 27.41 kB │ gzip: 6.51 kB
+dist/tasks/interactiveCaptcha/interactiveCaptchaManager.js               18.40 kB │ gzip: 4.85 kB
+dist/api/verify.js                                                       18.64 kB │ gzip: 3.57 kB
+dist/tasks/frictionless/frictionlessTasks.js                             19.65 kB │ gzip: 5.30 kB
+dist/api/captcha/getFrictionlessCaptchaChallenge/handler.js              19.73 kB │ gzip: 4.75 kB
+dist/tasks/powCaptcha/powTasks.js                                        24.47 kB │ gzip: 6.18 kB
+dist/tasks/captchaManager.js                                             25.68 kB │ gzip: 7.58 kB
+dist/tasks/imgCaptcha/imgCaptchaTasks.js                                 27.18 kB │ gzip: 6.46 kB
 
-✓ built in 219ms
+✓ built in 171ms
 [copy-plugin] copying /home/runner/work/captcha/captcha/packages/provider/src/tasks/detection/decodeBehavior.js to /home/runner/work/captcha/captcha/packages/provider/dist/tasks/detection/decodeBehavior.js
 [copy-plugin] copying /home/runner/work/captcha/captcha/packages/provider/src/tasks/detection/decodePayload.js to /home/runner/work/captcha/captcha/packages/provider/dist/tasks/detection/decodePayload.js
 [copy-plugin] copying /home/runner/work/captcha/captcha/packages/provider/src/tasks/detection/decodeSimd.js to /home/runner/work/captcha/captcha/packages/provider/dist/tasks/detection/decodeSimd.js

package/CHANGELOG.md

@@ -1,5 +1,198 @@
 # @prosopo/provider
 
+## 5.16.0
+### Minor Changes
+
+- b299a91: An audio challenge, offered only as an accessibility alternative, like reCAPTCHA's audio option. The user hears a short sequence of spoken digits and types them in.
+  
+  It is off by default and needs two switches. Prosopo has to turn on the `captchaTypeFeatureFlags.audio` feature flag for the site, which the site owner cannot do, and the site owner has to set `audioAccessibilityEnabled`. When both are on, image, puzzle and icon-order challenges show a "Use audio instead" button. Pressing it swaps the visual challenge for the audio one. After a wrong answer the user stays on audio and gets a fresh clip.
+  
+  Audio is never a captcha type that can be selected or routed to. A site's `captchaType`, traffic-filter categories, Restrict rules and the site-key CLI all reject it, and routing, PoW escalation and the severity tiers leave it out. The provider only serves audio against the visual session the user was already given, and only on a site with both switches on; any other audio request is refused before the session is used up, and a request without a session is always refused.
+  
+  The spoken digits are synthesised by `@prosopo/audio-assets`, so there is no recorded set of clips to collect. The answer never leaves the provider, and a challenge can be submitted and verified only once, even under concurrent requests. `@prosopo/procaptcha-audio` is the widget. It and the "Use audio instead" button are built on the shared widget code in `@prosopo/procaptcha-common`, and the provider side is built on the shared interactive-captcha code that puzzle and icon-order use.
+  
+  The demo playground has audio pages, and there is an end-to-end test for it.
+- e13d7a8: New captcha type: `iconOrder`. The user is shown a frame of icons and a legend, and clicks the legend's icons in the order given.
+  
+  Icon-order is off by default. Only Prosopo can switch it on for a site, with the `captchaTypeFeatureFlags.iconOrder` feature flag; the site owner cannot. A site without the flag is never served icon-order by any route, and the challenge endpoint refuses it. Once the flag is on, the owner can still keep icon-order out of the frictionless flow with `frictionlessTypes.iconOrder`, the same way as image and puzzle.
+  
+  The answer never leaves the provider. Icon positions are stored on the challenge record, and the widget receives only the rendered frame and legend. Grading checks order as well as position, and each icon's hit radius scales with its size. Verifying a token is single-use under concurrent requests.
+  
+  `@prosopo/icon-order-assets` draws the imagery, and `@prosopo/procaptcha-icon-order` is the widget. Its text is translated into every supported language.
+  
+  Puzzle and icon-order now share their server code: challenge and solution handlers, the verify route, the submit and verify pipeline, and the database record methods. The widget code they have in common moves into `@prosopo/procaptcha-common`: the lazy mount wrapper, manager expiry and dispose, spent-session handling, behavioural data encryption and trusted click coordinates. Puzzle's behaviour is unchanged.
+  
+  The demo playground has icon-order pages, and there is an end-to-end test for it.
+- 270395d: Allow maintenance mode to be scoped to specific site keys.
+  
+  Maintenance mode was all-or-nothing for a whole provider process. If one
+  customer's traffic needed to be taken out of scoring, the only option was to put
+  the entire node into maintenance mode, which forces a pass for every other
+  customer on it too — so in practice it was not used.
+  
+  The admin toggle now accepts an optional `siteKeys` list. With it, only those
+  keys are taken out of scoring and the node-wide flag is left untouched; without
+  it, the behaviour is exactly as before, which is what the deploy path relies on.
+  
+  Scoped maintenance mode is applied in the verify handlers only after the dapp
+  signature has been checked, so the decision is made on a site key the caller has
+  proven it owns rather than one it merely asserted.
+  
+  Same durability as the existing flag: per-process, cleared on restart, and set
+  per node.
+
+### Patch Changes
+
+- Updated dependencies [b299a91]
+- Updated dependencies [e13d7a8]
+- Updated dependencies [270395d]
+  - @prosopo/types@5.14.0
+  - @prosopo/types-database@5.9.0
+  - @prosopo/database@4.2.0
+  - @prosopo/api@4.5.0
+  - @prosopo/audio-assets@0.2.0
+  - @prosopo/locale@3.8.0
+  - @prosopo/captcha-severity@1.3.0
+  - @prosopo/user-access-policy@3.14.16
+  - @prosopo/keyring@2.10.2
+  - @prosopo/icon-order-assets@0.2.0
+  - @prosopo/puzzle-assets@0.2.1
+  - @prosopo/api-express-router@3.2.2
+  - @prosopo/common@3.1.63
+  - @prosopo/datasets@3.2.2
+  - @prosopo/env@3.6.70
+  - @prosopo/ipinfo@0.4.15
+  - @prosopo/load-balancer@2.11.6
+  - @prosopo/types-env@2.11.16
+
+## 5.15.0
+### Minor Changes
+
+- 1c13037: Add `captchaTypeFeatureFlags` to site settings, starting with `puzzle`. Setting
+  `puzzle: false` stops a site being served the puzzle captcha by any path: its
+  configured `captchaType`, `frictionlessTypes`, access policies, the traffic
+  filter, routing machines, PoW escalation, and puzzle sessions that already
+  exist. A site pinned to puzzle gets an image captcha instead (or PoW if image is
+  also off). The field is optional and has no stored default, so sites that never
+  set it behave exactly as before. The flag is meant for Prosopo staff, not site
+  owners.
+- f961dab: Store everything needed to redraw a puzzle, so the portal can show the exact challenge a user was served.
+  
+  Until now a puzzle record kept the target, the origin and the accuracy required (`tolerance`), and
+  nothing else. The things that decide what the puzzle actually looked like — how many decoy shapes were
+  scattered on it, how dark they were, how big the piece was, and which background was used — were
+  picked per challenge and then thrown away. So you could see that someone failed by 11px and had no way
+  to know whether they had been handed an easy puzzle or a nasty one.
+  
+  Puzzle records now carry a `render` object with all of it: the difficulty ladder level, the piece size,
+  the frame geometry, the five render settings, and the two 128-bit seeds that regenerate the imagery.
+  Given those, the portal reproduces the background and the piece byte for byte.
+  
+  To make that possible the renderer had to become reproducible. `renderPuzzle` and `createBackground`
+  now take an optional seed and report the one they used, instead of generating one internally and
+  discarding it; the background pool hands out each image together with its seed. Default behaviour is
+  unchanged — omit the seed and you still get a fresh random one.
+  
+  The ladder level is new on the session too (`puzzleLevel`), because it was computed when the puzzle
+  was escalated and never written down anywhere. It is absent when the ladder did not choose the
+  puzzle — a site-configured puzzle or a traffic-filter override has no level.
+  
+  The record is patched after the imagery is produced rather than written with the rest of the record,
+  because the piece size and the seeds only exist once the render has run, and the target has to be
+  durable before it is expressed in pixels. If that patch fails it is logged and ignored: losing a
+  diagnostic must not cost the user their solve. Records written before this change, and any challenge
+  whose render threw, simply have no `render`.
+  
+  **The seeds are secret.** `puzzle-assets/src/prng.ts` explains why: they regenerate the clean
+  background, and a clean background can be diffed against the composite to read the target position
+  straight off. They were previously barred from leaving the provider entirely. They may now sit on the
+  captcha record, and nowhere else — not in a response, not in a log, not on the session. Anything that
+  exposes a puzzle record to a caller has to drop `render.backgroundSeed` and `render.renderSeed`, and
+  must not serve them at all while the challenge is still live. The comment in `prng.ts` now says so.
+  
+  Test coverage. Three guards, each confirmed to fail when the thing it protects is broken:
+  `renderReplay.unit.test.ts` re-renders from the stored fields and asserts the bytes match, with one
+  case per field asserting that changing *only* that field changes the output — so a record missing a
+  field cannot pass; `puzzleRenderer.unit.test.ts` replays through the same entry points the portal would
+  use, which catches a background paired with the wrong seed; and `schemas.test.ts` asserts every
+  sub-field survives a strict-mode mongoose write, since a field absent from the schema is dropped
+  silently and would store nothing at all.
+- 1ce9482: Cap automatic puzzle escalation one rung lower on touch devices than on pointer devices.
+  
+  The puzzle's `tolerance` is an absolute CSS-pixel target and the widget renders into a fixed 300x200 container on every device, so a difficulty level asks the same placement accuracy of a fingertip as it does of a mouse.
+  
+  `MAX_AUTO_ESCALATION_LEVEL_TOUCH` and `resolveMaxEscalationLevel(siteMaxLevel, isTouch)` are new in `@prosopo/captcha-severity`. The resolver takes the stricter of the site's own `puzzleMaxDifficulty` and the device ceiling, so a site set to 3 or 4 cannot out-vote the touch ceiling and a site pinned to 0 is not raised by it.
+  
+  The provider now calls it from both places a puzzle difficulty is chosen: `sendCaptcha`, which reads `routingContext.platform.isMobile`, and the post-PoW escalation in `submitPoWCaptchaSolution`, which derives the platform from the originating session. That second path previously ignored the site's `puzzleMaxDifficulty` entirely and always clamped to the global ceiling; it now respects both caps.
+  
+  Desktop behaviour is unchanged, and L4 stays unreachable by automatic escalation on either device.
+- dcb691b: Add a refresh control to the puzzle captcha.
+  
+  A user who can't solve the puzzle they were given can now ask for a different one, from a button in the puzzle's header. The replacement comes through a new frictionless session, like a wrong answer already does.
+  
+  The widget tells the provider which session was refreshed (`refreshOf`). The provider then records `refreshOf`, `refreshCount` and `refreshedAfterMs` on the new session, so refresh behaviour can be scored later. After three refreshes in a row it serves an image challenge instead, with reason `PUZZLE_REFRESH_LIMIT`. It only does this if the site has image enabled. The switch only goes from puzzle to image, so a client that lies about its refreshes can only make its own challenge harder. A client that leaves the field out gets a normal session, the same as reloading the page.
+  
+  The image widget's reload button now reports itself as a refresh too. That way a user who was moved onto image isn't sent back to the puzzle by their next reload.
+
+### Patch Changes
+
+- 7d57d2a: A proof-of-work solve is checked against the address the challenge was issued to, and a mismatch sends the user to an image captcha instead of approving them. That check compared the whole IPv4 address, so it fired for anyone whose address moved between asking for the challenge and solving it — which is normal behaviour on mobile and on carrier NAT, where the low octet gets reassigned mid-session. One EE subscriber was seen moving one address along in four seconds.
+  
+  It now compares the /24, so a reassignment inside the same pool reads as the same place on the network. IPv6 already worked this way on the /64, for the same reason, and is unchanged. A solve arriving from a genuinely different network is still caught and still escalates, so the point of the check survives.
+  
+  Unit tests cover a low-octet reassignment, both ends of a /24, two different /24s, and a pair of adjacent addresses that straddle the /24 boundary.
+- 2118584: Trim the comments on the puzzle difficulty device ceiling. No behaviour change.
+- 80b7780: Post-PoW routing now receives the widget mode from the originating session and whether the submitted click coords were all (0,0), so a routing rule can escalate visible-mode solves that carry no real click position.
+- dd4c27c: Store the whole-SYN fields the tcp-probe sidecar now reports.
+  
+  The sidecar's handshake record grew from 80 to 104 bytes and the tail was reordered (prosopo/Protect#1167). chaddy was updated to read both layouts and to forward the new fields as their own headers (prosopo/chaddy#16, #17); this is the provider side of that, so the values have somewhere to land instead of being dropped at the middleware.
+  
+  Twelve new fields on `Session`, all optional: `tcpOptsKinds`, `tcpOptsPresent`, `tcpOptsCount`, `tcpTsval`, `tcpTsecr`, `tcpFlags`, `tcpDataOffsetResv`, `tcpUrgPtr`, `ipIdent`, `ipTotalLen`, `ipFragFlags`, `ipTos`. They are surfaced on the decision-machine input the same way the existing TCP fields are, so routing and verify rules can read them.
+  
+  `tcpOptsKinds` is stored decoded — the IANA kind number of each TCP option in wire order, `[2, 4, 8, 1, 3]` on an ordinary Linux SYN. The probe emits it packed into a u64, and a u64 reaches 2^64 while a JS number is exact only to 2^53, so the packed form could not be held without rounding; the rounding would land in the low bytes, which are the option kinds themselves. The array holds the same information and is queryable per position. It also replaces the old `tcpOptsOrder`, which packed 4 bits per option and so could not tell MSS from TCP Fast Open, or Window Scale from MD5, and could not represent MPTCP at all.
+  
+  `tcpOptsFlags` and `tcpOptsOrder` are kept and still read. A pronode running an older chaddy still sends them, and years of rows hold them, so removing them would both lose the rollout window and break any routing rule already reading them. They go undefined on new sessions once the fleet is rolled.
+  
+  `tcpTsval` and `tcpTsecr` are written only when the Timestamps option was actually on the SYN. A TSval of 0 is legal and a TSecr of 0 is expected, so neither can use zero to mean absent.
+  
+  Six places named every one of these fields by hand — the middleware's copy onto the request, the session write, and four task files building the decision-machine bag. They now all go through one list, with a compile-time check that every field of `RawTlsSignals` is on it. That is not tidying: the Session projection comment in `@prosopo/types-database` records a field being missed in exactly this way, after which the rules reading it got `undefined` and silently never fired against real traffic.
+  
+  Separately, the provider compose no longer defaults the sidecar to `prosopo/tcp-probe:latest`. The probe's reply is a bare fixed-size struct with no version in it, so the image tag is the only statement of which layout a host serves, and publishing `:latest` would change that on every pronode at the next pull with nobody running a deploy. The default is now the `0.1.1` both Protect inventories already pin.
+  
+  Tests: the new headers all parse; a packed value above 2^53 decodes without losing its low bytes; the kind pairs the old encoding aliased stay distinct; a trailing end-of-option-list terminates the list rather than appearing in it; an all-zero packed value reads as absent rather than as an empty list; malformed and out-of-range values are ignored; the legacy header pair is still read; and a zero is kept rather than dropped, since `ipIdent` 0 and `tcpTsecr` 0 are real readings.
+- Updated dependencies [1c13037]
+- Updated dependencies [f961dab]
+- Updated dependencies [a17e8eb]
+- Updated dependencies [7d57d2a]
+- Updated dependencies [2118584]
+- Updated dependencies [1ce9482]
+- Updated dependencies [6e2eb55]
+- Updated dependencies [dcb691b]
+- Updated dependencies [80b7780]
+- Updated dependencies [dd4c27c]
+  - @prosopo/types@5.13.0
+  - @prosopo/types-database@5.8.0
+  - @prosopo/puzzle-assets@0.2.0
+  - @prosopo/util@3.3.14
+  - @prosopo/captcha-severity@1.2.0
+  - @prosopo/api@4.4.0
+  - @prosopo/locale@3.7.0
+  - @prosopo/api-express-router@3.2.1
+  - @prosopo/common@3.1.62
+  - @prosopo/database@4.1.4
+  - @prosopo/datasets@3.2.1
+  - @prosopo/env@3.6.69
+  - @prosopo/ipinfo@0.4.14
+  - @prosopo/keyring@2.10.1
+  - @prosopo/load-balancer@2.11.5
+  - @prosopo/types-env@2.11.15
+  - @prosopo/user-access-policy@3.14.15
+  - @prosopo/api-route@2.6.63
+  - @prosopo/logger@2.1.3
+  - @prosopo/redis-client@1.0.40
+  - @prosopo/util-crypto@13.6.0
+  - @prosopo/web-bot-auth@0.1.3
+
 ## 5.14.0
 ### Minor Changes